FKIE_CVE-2021-42064

Vulnerability from fkie_nvd - Published: 2021-12-14 16:15 - Updated: 2024-11-21 06:27
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.
References
cna@sap.comhttps://launchpad.support.sap.com/#/notes/3114134Permissions Required
cna@sap.comhttps://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://launchpad.support.sap.com/#/notes/3114134Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021Vendor Advisory
Impacted products
Vendor Product Version
sap commerce 1905
sap commerce 2005
sap commerce 2011
sap commerce 2105
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:commerce:1905:*:*:*:*:*:*:*",
              "matchCriteriaId": "F665F648-5C35-4EC8-8064-8ED139C8813C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2005:*:*:*:*:*:*:*",
              "matchCriteriaId": "C788164A-7724-4CB1-8ADC-B05ADE595020",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2011:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DE31C0C-31D7-468E-B1D4-CE522086EDD3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:commerce:2105:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BF52269-A749-4A58-A291-ACD4C41C6FAF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized \"in\" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized \"in\" clause accepts more than 1000 values."
    },
    {
      "lang": "es",
      "value": "Si es configurado para usar una base de datos Oracle y si se crea una consulta usando la api java de b\u00fasqueda flexible con una cl\u00e1usula \"in\" parametrizada, SAP Commerce - versiones 1905, 2005, 2105, 2011, permite al atacante ejecutar consultas de base de datos dise\u00f1adas, exponiendo la base de datos del backend. La vulnerabilidad est\u00e1 presente si la cl\u00e1usula \"in\" parametrizada acepta m\u00e1s de 1000 valores"
    }
  ],
  "id": "CVE-2021-42064",
  "lastModified": "2024-11-21T06:27:10.540",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-12-14T16:15:09.303",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3114134"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/3114134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wiki.scn.sap.com/wiki/display/PSR/SAP+Security+Patch+Day+-+December+2021"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.